OTTAWA - Passport Canada's online application service was shut down last month because of security concerns, says an internal document.

That rationale for killing Passport On-Line on April 30 is at odds with the public explanation that the online service was simply not "convenient" for Canadians.

Instead, a report into a 2007 website security breach shows that Passport Canada's "action plan" to correct the problem included an end to the online service.

The agency now offers a downloadable form that applicants can fill out, print out on paper and bring in to a Passport Canada office.

The unusual switch to a paper option from a network option is outlined in a draft report to Canada's privacy commissioner about the 18-month-old online breach.

The Canadian Press obtained the document, dated January this year, under the Access to Information Act.

A Huntsville, Ont., man contacted the passport agency on Nov. 29, 2007, to say he had been able to access personal information from another applicant on the Passport On-Line website through his computer.

The breach allowed ready access to driver's licence numbers, health card numbers, social insurance numbers, home addresses and telephone numbers.

Passport Canada took down its online service 90 minutes later, tried to fix the problem, and got it running for just 15 minutes the following day before it crashed.

Service was restored three days later, but a journalist advised the agency he was able to access personal information, forcing another shutdown, this one for five hours.

In December last year, Privacy Commissioner Jennifer Stoddart reported that the breach exposed a "gap in the system" that was "likely caused by human error, which can be limited, but not totally eliminated in any complex IT (information technology) system."

Passport Canada's final report on the incident, due March 31 this year, has still not been delivered to Stoddart's office.

A draft version obtained by The Canadian Press, however, shows that the passport agency could not identify any other breaches of the website in its review of transactions that took place between June and December 2007.

The investigation also showed that the Ontario man who first reported the problem had partial access to the information of 23 people, and the journalist to that of five people.

When the agency first announced the demise of Passport On-Line, a spokesman said it had been "replaced by interactive forms because they are more convenient for applicants."

Passport On-Line was launched in January 2005 with a promise it would reduce waiting times. The system stored an average of 28,000 active passport applications at any one time.

A spokesman says about 14,000 downloadable printed forms have been arriving each week since the new service was offered, compared with only about 1,000 online applicants each week in the final two months of Passport On-Line.

"The numbers show that people are really, really pleased with this new and easy way of filing the form," said Sebastien Bois, adding that the downloadable form had been in development regardless of the security breach.

He also noted that with the online service, applicants still had to provide hard copies of photographs and documents to passport offices to supplement their web information.

Bois said there was no discrepancy in the public explanation for the demise of Passport On-Line because applicants flocking to the new downloadable form clearly do find it more convenient.

The passport office expects to issue more than five million passports in 2009-2010 as Canadians gear up for tougher U.S. land-border rules that kick in June 1.

Passports, currently valid for five years, cost $87.